1.6 System Security Flashcards
Define malware
MALicious softWARE written to infect computers and commit crimes such as fraud and identity theft.
Define virus
Malware designed to cause harm to a network or computer.
Most have a human element to them.
Attaches itself to programs or files on a computer or server.
Almost all are attached to an executable file, so the virus may exist on a system; won’t be active or able to spread until a user runs or opens the malicious host file or program.
Often spread through files, programs, emails, messages or games that you download.
Define worms
Replicates itself to spread to other computers often using a computer network and fills up the RAM.
To achieve this, the worm exploits vulnerabilities across the computer network.
Unlike a virus, it doesn’t need to attach to a program.
Define trojan horse
Harmful piece of software that looks legitimate.
Users are typically tricked into loading and executing it on their systems.
After it’s activated, it can achieve any number of attacks on the host.
Create back doors to give malicious users access to the system.
Trojans must spread through user interaction such as opening an e-mail attachment or downloading and running a file from the internet.
Define network policies
How a system can be secured through specific rules or requirements.
Define firewalls
Software that performs a “barrier” between a potential attacker and the computer system.
Can be held on a server, or a standalone computer.
Many have this feature as part of an anti-virus package.
Not 100% effective – an attacker could exploit a vulnerability.
Monitors applications and network usages.
Can block access from certain computer users and disable processes which may be perceived as a threat.
Define penetration testing
Tests performed under a controlled environment by a qualified person.
Checks for current vulnerabilities and explores potential ones in order to expose weaknesses in the system so they can’t be maliciously exploited.
May use tools to help them in their duties.
What are the effects of malware?
1) Computer may crash, reboot spontaneously or slow down without any logical explanation.
2) When a worm infects a computer, the internet connection may become slow as the worm searches online for other computers to infect.
3) Files may be deleted, become corrupt or encrypted.
4) Hackers record typed keys of computer so they know passwords.
How can you prevent malware?
1) Strong security software (firewall, spam filter, anti-virus, anti-spyware, anti-spam).
2) Enable OS updates.
3) Staff training: caution opening attachments.
4) Back up files regularly.
Define social engineering
Relies on human interaction (social skills).
Commonly involves tricking users into breaking normal security procedures.
Method doesn’t revolve around technical cracking techniques such as: worms or viruses.
Define phishing
Form of social engineering.
Designed to acquire sensitive information such as: usernames, passwords, card details etc.
Most common phishing attacks are sent through email.
What are the effects of phishing?
1) Accessing a victim’s account and withdraw money or purchase merchandise or services.
2) Open new bank or credit-card accounts in a victim’s names, and use the new account to cash illegitimate checks or purchase merchandise.
3) Gaining access high-value corporate data.
4) Financial services can blacklist institutions, resulting in reputational damage.
How can you prevent phishing?
1) Strong security software (firewall, spam filter, anti-virus, anti-spam).
2) Staff training: awareness of spotting fake websites & amp; emails.
3) Staff training: never disclose personal or financial information.
4) Staff training: disable pop-ups.
Define brute force attack
Trial and error method used by programs to decode encrypted data such as: passwords or Data Encryption Standard (DES) keys, through exhaustive effort rather than employing intellectual strategies.
What are the effects of brute force attack?
1) Theft of data.
2) Access to corporate systems.
How can you prevent brute force attacks?
1) Network lockout policy: locks out after number of tries expires.
2) Effective software: progressive delays.
3) Staff training: using effective passwords that contain symbols and numbers.
4) Challenge response tests e.g. reCAPTCHA.
Define denial of service attack
Flooding a server with useless traffic causes servers to become overloaded preventing them responding to legitimate client-server requests from users.
What are the effects of denial of service attack?
1) Revenue losses: downtime affects profits.
2) Productivity Loss.
3) Reputation Damage.
How can you prevent denial of service attacks?
1) Strong security software (firewall).
2) Packet filters on routers.
3) Configuration of the web server.
4) Good network policy: audits, logs, monitoring.
Define data interception and theft
An attacker monitors data streams to/from a target, in order to gather sensitive information.
What are the effects of data interception and theft?
1) Discovering username and password credentials.
2) Gaining access to systems.
3) Disclosure of corporate data.
4) Theft of data.
How can you prevent data interception and theft?
1) Strong encryption.
2) Using virtual networks.
3) Staff training: use of passwords, locking and portable storage devices.
4) Network forensics.
Define SQL injection
A code injection technique, used to attack data-driven applications.
What are the effects of SQL injection?
1) Contents of the database can be output, revealing data that otherwise would be hidden.
2) Data in the database can be amended and deleted.
3) New rogue records can be added.
How can you prevent SQL injection?
1) Validation of input fields.
2) Using parameterised queries.
3) Using database permissions.
4) Penetration testing.
There are few/many ways in which networks can be attacked
many
True/False: Networks can be attacked by targeting the people who use them
True
What does social engineering involve?
Tricking people into divulging secret information such as passwords and login information
Give an example of private information that can be given when tricking people as a result of social engineering
Anything such as passwords, login information, etc
What does phishing involve?
Emailing someone claiming or appearing to be from a bank or building society e-commerce site, asking for details of passwords or credit cards
What does shouldering involve?
Finding passwords and PINs by watching people enter them. This could happen in a busy office or at a distance using binoculars or recording equipment
All organisations should have an __________ use policy
acceptable
What must users do when there is an acceptable use policy in place?
Read it, sign it and abide by it
List things that should be included in an acceptible use policy
Any from users must not use their own devices on the network, users must not download files from the internet, etc
Why should users on a network not use their own devices such as USB flash drives?
These pose a threat as malware can be introduced to the network and data can be removed and stolen
Why should users connected to a network not download files from the internet?
They could be infected with malware
____ passwords are a major security risks
Weak
What is a weak password?
A password that can be easily and quickly guessed by humans and computers
Hackers often use _____-_____ techniques to try different combinations of letters, numbers and symbols to get in to a system
brute force
Brute-force software tries…to get in to a system
every single combination of letters, numbers and symbols until it finds the correct combination
A long password with a combination of what will take longer to guess?
Letters, numbers and symbols
Passwords should be changed _________
regularly
True/False: You should reuse old passwords
False, old passwords should never be reused
Why should dates of birth and relatives names never be used in passwords?
Hackers can find them out
Many forms of attack target users by getting them to install _______ (harmful software) on their computers
malware
What is malware?
Software that has been designed to gain unauthorised access to a computer system in order to disrupt its functioning, or collect information
Malware is software that has been designed to gain unauthorised access to a computer system in order to…
disrupt its functioning, or collect information
Malware is software that has been designed to gain what to a computer system?
Unauthorised access
What is a virus?
A computer program hidden inside another program which can delete or corrupt data on an infected computer
A virus can _________ itself and insert itself into other programs or files that can then be passed on
replicate
Viruses can delete or _______ data held on an infected computer
corrupt
A worm needs/does not need another program to carry it
does not need
A work can replicate and send itself in emails that are then sent to everyone in a user’s…
address book
What do worms consume? (Computer Science)
Computer resources as they are reproducing
Why do worms consume computer resources as they are reproducing?
To allow criminals to gain access to an infected computer and take it over
Trojans are installed by _____
users
When do users install trojans?
When they think they are installing legitimate software
What can trojans do?
Delete files, change the desktop layout and send screenshots and key presses to a hacker’s computer
Spyware often comes packaged with what?
Other software
Users do/do not know that they are installing spyware
do not
What does spyware do?
Spies on the user like a trojan by sending information to a criminal
To prevent infection, you can install _________ software and ensure that it is constantly updated
antivirus
To prevent infection, you can ensure that _________ software can scan emails
antivirus
To prevent infection, you can install anti-spyware protection software that…
removes or blocks spyware
To prevent infection, you can avoid opening emails and attachments from…
unknown sources
To prevent infection, you can install a ________ to ensure that software is not downloaded without your knowledge
firewall
True/False: To prevent infection, you can ensure that an operating system is up to date
True
To prevent infection, you can install the latest ________ updates
security
Many attacks on networks use methods that bypass the users and target…
the network operating system and security
What are brute-force attacks?
Attacks where automated software tries millions of different password cobinations to get in to a system
Brute-force attacks are general attacks that need little/lots of special knowledge and techniques
Little
In a brute-force attack, automated software is used to try…
millions of different passwords
Success in a brute-force attack is based on…
computing power rather than any specialist techniques
What does data interception and theft involve?
The use of packet sniffers to intercept data packets on a network, which are then analysed
What do packet sniffers do?
Intercept data packets on a network and analyse them
What can be obtained during data interception and theft?
Sensitive data such as login names, passwords and credit card numbers
What does DoS stand for?
Denial of Service
What are denial of service attacks?
An overload on a network or website by flooding it with network communications such as login requests
What does DDoS stand for?
Distributed denial of service
Malware can be used to take control of lots of computers (zombies) that will all send information and login requests at the same time. This is called…
A distributed denial of service (DDoS) attack
True/False: DoS attacks may be used to extort money or they may be organised by rival organisations
True
Why are DoS attacks often used by hacktivists?
To punish organisations they think are unethical
SQL injection exploits…
personal and financial data held on websites stored in huge databases
Give an example of a site that stores personal and financial data in huge databases, which can be exploited by SQL injection
Any from social networking sites, banks, online commerce sites, etc
SQL stands for…
Structured Query Language
SQL is used to __________ data
manipulate
Give an example of how SQL is used to manipulate data
Any from to create new records, search for information, check login names and passwords, etc
Why would criminals want to create commands entered in login fields to bypass security?
To gain access to records and steal valuable data such as names, addresses and bank details
Although a brute-force attack may be able to gain access to an account eventually, these attacks can take…
several hours, days, months and even years to run
What does the time to complete a brute-force attack depend on?
The password and the power of the computer(s) used to conduct the attack
Why are brute-force attacks called brute-force attacks?
No specialist techniques are used. Raw computing power is used to try millions of combinations
All networks must be protected against unauthorised access by…
identifying risks and applying measures to prevent them
Penetration testing is used to…
test a computer system or network in order to find vulnerabilities that an attacker could exploit
In penetration testing, testers take the role of hackers and…
try to gain unauthorised access
Penetration testing assesses…
the security awareness of users and demonstrates the effectiveness of network security policies
What are network forensics?
The monitoring, recording and analysis of network events
Give 2 examples of events that can be monitored with network forensics
Any 2 from who has logged in, how many unsuccessful attempts have been made, what users have done and what has been deleted
Network forensics can identify…
unusual network activity
Network forensics analysis can be used as legal evidence if…
illegal activity is detected
Passwords should/shouldn’t be strong
should
A strong should include…
at least eight characters and include non-alphanumeric characters
Passwords should/shouldn’t be changed regularly
should
Passwords should never be written down or…
shared
Old passwords should never be…
reused
User access levels are used to set…
which files and folders users are allowed to access and at what level
User access levels set which files and folders users are allowed to…
see, browse, edit or delete
What are network policies?
Rules that set out what users can and cannot do on a network
Give an example of something that may be in a network policy
Any from must not use removable storage devices, install their own software, download files from internet sites. etc
Users of a network should/shouldn’t use removable storage devices
shouldn’t
Users of a network should/shouldn’t install their own software and download files from internet sites
shouldn’t
Network policies should set out when backups will be made and where…
they will be kept
What policies should have rules which sets out what should be done if there is a problem or breach of security?
Network policies
Workers on a network who use removable media must…
abide by policies put in place to safeguard the business network
State two types of removable media that workers might use on their journey to and from work
Any 2 from smartphone, mp3 player and camera
State two reasons why the use of removable media on a network at work mught be restricted
Malware could be introduced to the network and data could be copied or stolen
System measures can also be taken to…
protect networks from threats
Anti-malware software is designed to…
detect and remove malware
Give an example of anti-malware software
Any from antivirus, spyware removal software, etc
Anti-malware software should be constantly…
updated to tackle new threats
Operating systems should be kept up to date as…
new security features are introduced
What is encryption?
The conversion of data into a form that cannot be understood unless a user knows how to convert it back again
The processes of converting data into a form that cannot be understood and converting it back again are called…
Encryption and decryption
A common method of encryption and decryption is using a…
‘public’ and ‘private’ key
How is a ‘public’ key used in encryption?
A user would encrypt a message to send using the recipient’s public key that is available to all
How is a ‘private’ key used in encryption?
Only the recipient’s private key is able to decrypt the message sent using the public key
What does a firewall do?
Protects a network connected to a WAN such as the internet
Firewalls can be provided by…
hardware or software
Firewalls can be configured to prevent ______________ from entering a network
communications
Firewalls can prevent what/who from accessing the internet from within a network?
Programs and users
